diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md
index c6b50e1f..ee8ba275 100644
--- a/nullplatform/code_repository/README.md
+++ b/nullplatform/code_repository/README.md
@@ -2,17 +2,18 @@
 
 ## Description
 
-Configures a nullplatform_provider_config resource for GitHub, GitLab, or Azure DevOps git provider integration within the Nullplatform platform
+Configures a nullplatform_provider_config resource for GitHub, GitLab, Azure DevOps, or Bitbucket git provider integration within the Nullplatform platform
 
 ## Architecture
 
-The module uses local values to evaluate which git provider is selected and conditionally creates a single nullplatform_provider_config resource based on the provider type. For GitLab, it creates a resource of type 'gitlab-configuration' with group_path, access_token, and installation_url attributes, extracting the parent NRN via regex. For GitHub, it creates a 'github-configuration' resource with organization and installation_id, and for Azure DevOps it creates an 'azure-devops-configuration' resource with project, access_token, and agent_pool, both stripping the namespace suffix from the NRN using replace(). All three resource variants share the nrn and dimensions inputs.
+The module uses local values to evaluate which git provider is selected and conditionally creates a single nullplatform_provider_config resource based on the provider type. For GitLab, it creates a resource of type 'gitlab-configuration' with group_path, access_token, and installation_url attributes, extracting the parent NRN via regex. For GitHub, it creates a 'github-configuration' resource with organization and installation_id; for Azure DevOps it creates an 'azure-devops-configuration' resource with project, access_token, and agent_pool; and for Bitbucket it creates a 'bitbucket-configuration' resource with workspace, project_key, email, api_token, installation_url, and flavor under setup plus collaborators under access. All variants strip the namespace suffix from the NRN using replace() (GitLab via regex) and share the nrn and dimensions inputs.
 
 ## Features
 
 - Creates a nullplatform_provider_config resource for GitLab with group path, access token, and installation URL
 - Creates a nullplatform_provider_config resource for GitHub with organization name and App installation ID
 - Creates a nullplatform_provider_config resource for Azure DevOps with project name, access token, and agent pool
+- Creates a nullplatform_provider_config resource for Bitbucket with workspace, project key, email, API token (sensitive), installation URL, flavor, and collaborators
 - Supports dimensional segmentation of provider configs via a dimensions map input
 - Validates that all provider-specific required variables are supplied when the corresponding git_provider value is selected
 
@@ -56,6 +57,21 @@ module "code_repository" {
 }
 ```
 
+### Usage with Bitbucket Integration
+
+```hcl
+module "code_repository" {
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.6.0"
+
+  git_provider          = "bitbucket"
+  bitbucket_workspace   = "your-bitbucket-workspace"    # Required when git_provider = "bitbucket"
+  bitbucket_project_key = "your-bitbucket-project-key"  # Required when git_provider = "bitbucket"
+  bitbucket_email       = "bot@your-org.com"            # Required when git_provider = "bitbucket"
+  bitbucket_api_token   = "your-bitbucket-api-token"    # Required when git_provider = "bitbucket" (sensitive)
+  nrn                   = "your-nrn"
+}
+```
+
 ## Using Outputs
 
 ```hcl
@@ -69,32 +85,40 @@ resource "example_resource" "this" {
 ## Requirements
 
 | Name | Version |
-|------|---------|
+| ---- | ------- |
 | <a name="requirement_nullplatform"></a> [nullplatform](#requirement\_nullplatform) | ~> 0.0.86 |
 
 ## Providers
 
 | Name | Version |
-|------|---------|
+| ---- | ------- |
 | <a name="provider_nullplatform"></a> [nullplatform](#provider\_nullplatform) | 0.0.95 |
 
 ## Resources
 
 | Name | Type |
-|------|------|
+| ---- | ---- |
 | [nullplatform_provider_config.azure](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/provider_config) | resource |
+| [nullplatform_provider_config.bitbucket](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/provider_config) | resource |
 | [nullplatform_provider_config.github](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/provider_config) | resource |
 | [nullplatform_provider_config.gitlab](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/provider_config) | resource |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
+| ---- | ----------- | ---- | ------- | :------: |
 | <a name="input_azure_access_token"></a> [azure\_access\_token](#input\_azure\_access\_token) | Azure devops personal access token | `string` | `null` | no |
 | <a name="input_azure_agent_pool"></a> [azure\_agent\_pool](#input\_azure\_agent\_pool) | Azure devops CI agent pool | `string` | `"Default"` | no |
 | <a name="input_azure_project"></a> [azure\_project](#input\_azure\_project) | Azure devops project name | `string` | `null` | no |
+| <a name="input_bitbucket_api_token"></a> [bitbucket\_api\_token](#input\_bitbucket\_api\_token) | Bitbucket API token used to authenticate against the Bitbucket API. | `string` | `null` | no |
+| <a name="input_bitbucket_collaborators"></a> [bitbucket\_collaborators](#input\_bitbucket\_collaborators) | Collaborators to grant repository access to. Each entry has an id, a role and a type. | <pre>list(object({<br/>    id   = string<br/>    role = string<br/>    type = string<br/>  }))</pre> | `[]` | no |
+| <a name="input_bitbucket_email"></a> [bitbucket\_email](#input\_bitbucket\_email) | Email of the Bitbucket account used together with the API token for authentication. | `string` | `null` | no |
+| <a name="input_bitbucket_flavor"></a> [bitbucket\_flavor](#input\_bitbucket\_flavor) | Bitbucket flavor. Only 'cloud' is supported at this time; the field exists so Data Center can be added later without reworking callers. | `string` | `"cloud"` | no |
+| <a name="input_bitbucket_installation_url"></a> [bitbucket\_installation\_url](#input\_bitbucket\_installation\_url) | Base URL for the Bitbucket integration. Defaults to Bitbucket Cloud. | `string` | `"https://bitbucket.org"` | no |
+| <a name="input_bitbucket_project_key"></a> [bitbucket\_project\_key](#input\_bitbucket\_project\_key) | Bitbucket project key under which repositories are created. | `string` | `null` | no |
+| <a name="input_bitbucket_workspace"></a> [bitbucket\_workspace](#input\_bitbucket\_workspace) | Bitbucket workspace that owns the repositories. | `string` | `null` | no |
 | <a name="input_dimensions"></a> [dimensions](#input\_dimensions) | Dimensions to segment the nullplatform provider config (e.g. by region, environment) | `map(string)` | `{}` | no |
-| <a name="input_git_provider"></a> [git\_provider](#input\_git\_provider) | Git provider to use (GitHub or GitLab). | `string` | n/a | yes |
+| <a name="input_git_provider"></a> [git\_provider](#input\_git\_provider) | Git provider to use (GitHub, GitLab, Azure DevOps or Bitbucket). | `string` | n/a | yes |
 | <a name="input_github_installation_id"></a> [github\_installation\_id](#input\_github\_installation\_id) | GitHub App installation ID for the organization. | `string` | `null` | no |
 | <a name="input_github_organization"></a> [github\_organization](#input\_github\_organization) | GitHub organization name for repository creation. | `string` | `null` | no |
 | <a name="input_gitlab_access_token"></a> [gitlab\_access\_token](#input\_gitlab\_access\_token) | Access token for authenticating with the Git provider API. | `string` | `null` | no |
diff --git a/nullplatform/code_repository/locals.tf b/nullplatform/code_repository/locals.tf
index 5cdafbf4..fa0abfdd 100644
--- a/nullplatform/code_repository/locals.tf
+++ b/nullplatform/code_repository/locals.tf
@@ -1,5 +1,6 @@
 locals {
-  is_gitlab = lower(var.git_provider) == "gitlab"
-  is_github = lower(var.git_provider) == "github"
-  is_azure  = lower(var.git_provider) == "azure"
+  is_gitlab    = lower(var.git_provider) == "gitlab"
+  is_github    = lower(var.git_provider) == "github"
+  is_azure     = lower(var.git_provider) == "azure"
+  is_bitbucket = lower(var.git_provider) == "bitbucket"
 }
diff --git a/nullplatform/code_repository/main.tf b/nullplatform/code_repository/main.tf
index 6edabb54..508ea236 100644
--- a/nullplatform/code_repository/main.tf
+++ b/nullplatform/code_repository/main.tf
@@ -44,3 +44,25 @@ resource "nullplatform_provider_config" "azure" {
     }
   )
 }
+
+/* If the git_provider variable has the value bitbucket, create this resource */
+resource "nullplatform_provider_config" "bitbucket" {
+  count      = local.is_bitbucket ? 1 : 0
+  nrn        = replace(var.nrn, ":namespace=.*$", "")
+  type       = "bitbucket-configuration"
+  dimensions = var.dimensions
+  attributes = jsonencode({
+    "setup" : {
+      "workspace" : var.bitbucket_workspace,
+      "project_key" : var.bitbucket_project_key,
+      "email" : var.bitbucket_email,
+      "api_token" : var.bitbucket_api_token,
+      "installation_url" : var.bitbucket_installation_url,
+      "flavor" : var.bitbucket_flavor
+    },
+    "access" : {
+      "collaborators" : var.bitbucket_collaborators
+    },
+    }
+  )
+}
diff --git a/nullplatform/code_repository/tests/code_repository.tftest.hcl b/nullplatform/code_repository/tests/code_repository.tftest.hcl
index 4280b265..1cabd747 100644
--- a/nullplatform/code_repository/tests/code_repository.tftest.hcl
+++ b/nullplatform/code_repository/tests/code_repository.tftest.hcl
@@ -76,6 +76,45 @@ run "gitlab_provider_config" {
   }
 }
 
+run "bitbucket_provider_config" {
+  command = plan
+
+  variables {
+    git_provider          = "bitbucket"
+    nrn                   = "organization=myorg:account=myaccount"
+    np_api_key            = "test-api-key"
+    bitbucket_workspace   = "myworkspace"
+    bitbucket_project_key = "MYPROJ"
+    bitbucket_email       = "bot@example.com"
+    bitbucket_api_token   = "atlassian-api-token"
+  }
+
+  assert {
+    condition     = nullplatform_provider_config.bitbucket[0].type == "bitbucket-configuration"
+    error_message = "Bitbucket provider config type should be 'bitbucket-configuration'"
+  }
+
+  assert {
+    condition     = strcontains(nullplatform_provider_config.bitbucket[0].attributes, "myworkspace")
+    error_message = "Attributes should contain the workspace"
+  }
+
+  assert {
+    condition     = strcontains(nullplatform_provider_config.bitbucket[0].attributes, "MYPROJ")
+    error_message = "Attributes should contain the project key"
+  }
+
+  assert {
+    condition     = strcontains(nullplatform_provider_config.bitbucket[0].attributes, "https://bitbucket.org")
+    error_message = "Attributes should default the installation URL to Bitbucket Cloud"
+  }
+
+  assert {
+    condition     = length(nullplatform_provider_config.github) == 0 && length(nullplatform_provider_config.gitlab) == 0
+    error_message = "Only the Bitbucket provider should be created for bitbucket"
+  }
+}
+
 run "gitlab_strips_namespace_from_nrn" {
   command = plan
 
diff --git a/nullplatform/code_repository/variables.tf b/nullplatform/code_repository/variables.tf
index 4d9a185d..efbea07d 100644
--- a/nullplatform/code_repository/variables.tf
+++ b/nullplatform/code_repository/variables.tf
@@ -1,9 +1,9 @@
 variable "git_provider" {
-  description = "Git provider to use (GitHub or GitLab)."
+  description = "Git provider to use (GitHub, GitLab, Azure DevOps or Bitbucket)."
   type        = string
   validation {
-    condition     = contains(["github", "gitlab"], var.git_provider)
-    error_message = "git_provider must be either 'github' or 'gitlab'."
+    condition     = contains(["github", "gitlab", "azure", "bitbucket"], var.git_provider)
+    error_message = "git_provider must be one of 'github', 'gitlab', 'azure' or 'bitbucket'."
   }
 }
 
@@ -111,6 +111,70 @@ variable "azure_agent_pool" {
   }
 }
 
+# Bitbucket-specific variables
+variable "bitbucket_workspace" {
+  description = "Bitbucket workspace that owns the repositories."
+  type        = string
+  default     = null
+  validation {
+    condition     = var.git_provider != "bitbucket" || var.bitbucket_workspace != null
+    error_message = "bitbucket_workspace is required when git_provider is 'bitbucket'."
+  }
+}
+
+variable "bitbucket_project_key" {
+  description = "Bitbucket project key under which repositories are created."
+  type        = string
+  default     = null
+  validation {
+    condition     = var.git_provider != "bitbucket" || var.bitbucket_project_key != null
+    error_message = "bitbucket_project_key is required when git_provider is 'bitbucket'."
+  }
+}
+
+variable "bitbucket_email" {
+  description = "Email of the Bitbucket account used together with the API token for authentication."
+  type        = string
+  default     = null
+  validation {
+    condition     = var.git_provider != "bitbucket" || var.bitbucket_email != null
+    error_message = "bitbucket_email is required when git_provider is 'bitbucket'."
+  }
+}
+
+variable "bitbucket_api_token" {
+  description = "Bitbucket API token used to authenticate against the Bitbucket API."
+  type        = string
+  sensitive   = true
+  default     = null
+  validation {
+    condition     = var.git_provider != "bitbucket" || var.bitbucket_api_token != null
+    error_message = "bitbucket_api_token is required when git_provider is 'bitbucket'."
+  }
+}
+
+variable "bitbucket_installation_url" {
+  description = "Base URL for the Bitbucket integration. Defaults to Bitbucket Cloud."
+  type        = string
+  default     = "https://bitbucket.org"
+}
+
+variable "bitbucket_flavor" {
+  description = "Bitbucket flavor. Only 'cloud' is supported at this time; the field exists so Data Center can be added later without reworking callers."
+  type        = string
+  default     = "cloud"
+}
+
+variable "bitbucket_collaborators" {
+  description = "Collaborators to grant repository access to. Each entry has an id, a role and a type."
+  type = list(object({
+    id   = string
+    role = string
+    type = string
+  }))
+  default = []
+}
+
 
 variable "nrn" {
   description = "Nullplatform Resource Name (NRN) — unique identifier for resources."
diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md
index 32eeda94..fb6bed86 100644
--- a/nullplatform/service_definition/README.md
+++ b/nullplatform/service_definition/README.md
@@ -2,11 +2,11 @@
 
 ## Description
 
-Creates a Nullplatform service specification with associated action and link specifications by fetching JSON templates from GitHub, GitLab, or a local filesystem path
+Creates a Nullplatform service specification with associated action and link specifications by fetching JSON templates from GitHub, GitLab, Bitbucket, or a local filesystem path
 
 ## Architecture
 
-The module fetches service, action, and link spec templates via the `http` data source from GitHub raw content URLs or GitLab API v4 file endpoints (or reads them from local disk when git_provider is 'local'). The parsed JSON templates are fed into a `nullplatform_service_specification` resource, which is then referenced by `nullplatform_action_specification` and `nullplatform_link_specification` resources created via for_each loops over the available_actions and available_links lists. Authentication headers are conditionally set based on the git_provider value and an optional repository_token, and all created specifications expose their ID and slug as outputs.
+The module fetches service, action, and link spec templates via the `http` data source from GitHub raw content URLs, GitLab API v4 file endpoints, or Bitbucket Cloud raw file endpoints (or reads them from local disk when git_provider is 'local'). The provider-specific URL is selected with an explicit conditional chain keyed on git_provider. The parsed JSON templates are fed into a `nullplatform_service_specification` resource, which is then referenced by `nullplatform_action_specification` and `nullplatform_link_specification` resources created via for_each loops over the available_actions and available_links lists. Authentication headers are conditionally set based on the git_provider value and an optional repository_token, and all created specifications expose their ID and slug as outputs.
 
 ## Features
 
@@ -15,6 +15,7 @@ The module fetches service, action, and link spec templates via the `http` data
 - Creates nullplatform_link_specification resources for each link template listed in available_links
 - Fetches spec templates from GitHub using raw content URLs with optional Bearer token authentication
 - Fetches spec templates from GitLab using API v4 file endpoints with URL-encoded paths and optional PAT authentication
+- Fetches spec templates from Bitbucket Cloud using raw file endpoints under the canonical repository URL; authenticates via HTTP Basic `email:api_token` when `bitbucket_email` is set (required for Atlassian API tokens) or via a Bearer token otherwise (for workspace/repository access tokens)
 - Supports local filesystem spec loading for offline or development workflows via a configurable local path
 - Controls service specification visibility by merging the primary NRN with additional NRNs via extra_visibile_to_nrns
 
@@ -43,21 +44,21 @@ resource "example_resource" "this" {
 ## Requirements
 
 | Name | Version |
-|------|---------|
+| ---- | ------- |
 | <a name="requirement_http"></a> [http](#requirement\_http) | ~> 3.0 |
 | <a name="requirement_nullplatform"></a> [nullplatform](#requirement\_nullplatform) | ~> 0.0.86 |
 
 ## Providers
 
 | Name | Version |
-|------|---------|
+| ---- | ------- |
 | <a name="provider_http"></a> [http](#provider\_http) | 3.5.0 |
 | <a name="provider_nullplatform"></a> [nullplatform](#provider\_nullplatform) | 0.0.95 |
 
 ## Resources
 
 | Name | Type |
-|------|------|
+| ---- | ---- |
 | [nullplatform_action_specification.from_templates](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/action_specification) | resource |
 | [nullplatform_link_specification.from_templates](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/link_specification) | resource |
 | [nullplatform_service_specification.from_template](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/service_specification) | resource |
@@ -65,12 +66,13 @@ resource "example_resource" "this" {
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
+| ---- | ----------- | ---- | ------- | :------: |
 | <a name="input_available_actions"></a> [available\_actions](#input\_available\_actions) | List of action template names to fetch from the service spec repository | `list(string)` | `[]` | no |
 | <a name="input_available_links"></a> [available\_links](#input\_available\_links) | List of link template names to fetch from the service spec repository | `list(string)` | <pre>[<br/>  "connect"<br/>]</pre> | no |
+| <a name="input_bitbucket_email"></a> [bitbucket\_email](#input\_bitbucket\_email) | Bitbucket account email, used only when git\_provider = "bitbucket". Set it when repository\_token is an Atlassian API token: those authenticate ONLY via HTTP Basic "email:api\_token" and return 401 with a Bearer header. Leave null when repository\_token is a Bitbucket workspace/repository access token, which is sent as a Bearer token. | `string` | `null` | no |
 | <a name="input_dimensions"></a> [dimensions](#input\_dimensions) | Key-value pairs for dimensions to be associated with the service specification | `map(string)` | `{}` | no |
 | <a name="input_extra_visibile_to_nrns"></a> [extra\_visibile\_to\_nrns](#input\_extra\_visibile\_to\_nrns) | Additional NRNs that should have visibility to the created service specification | `list(string)` | `[]` | no |
-| <a name="input_git_provider"></a> [git\_provider](#input\_git\_provider) | Git provider to fetch service specs from. Supported values: "github", "gitlab", "local". | `string` | `"github"` | no |
+| <a name="input_git_provider"></a> [git\_provider](#input\_git\_provider) | Git provider to fetch service specs from. Supported values: "github", "gitlab", "bitbucket", "local". | `string` | `"github"` | no |
 | <a name="input_gitlab_host"></a> [gitlab\_host](#input\_gitlab\_host) | GitLab host. Only used when git\_provider = "gitlab". Override for self-hosted instances (e.g. "gitlab.mycompany.com"). | `string` | `"gitlab.com"` | no |
 | <a name="input_local_specs_path"></a> [local\_specs\_path](#input\_local\_specs\_path) | Absolute path to the local service directory containing specs/. Required when git\_provider = "local". The directory must contain specs/service-spec.json.tpl and optionally specs/links/*.json.tpl and specs/actions/*.json.tpl. | `string` | `null` | no |
 | <a name="input_nrn"></a> [nrn](#input\_nrn) | Nullplatform Resource Name (organization:account format) | `string` | n/a | yes |
@@ -84,7 +86,7 @@ resource "example_resource" "this" {
 ## Outputs
 
 | Name | Description |
-|------|-------------|
+| ---- | ----------- |
 | <a name="output_service_specification_id"></a> [service\_specification\_id](#output\_service\_specification\_id) | The ID of the created service specification |
 | <a name="output_service_specification_slug"></a> [service\_specification\_slug](#output\_service\_specification\_slug) | The slug of the created service specification |
 <!-- END_TF_DOCS -->
diff --git a/nullplatform/service_definition/data.tf b/nullplatform/service_definition/data.tf
index 0d680087..13035235 100644
--- a/nullplatform/service_definition/data.tf
+++ b/nullplatform/service_definition/data.tf
@@ -1,28 +1,28 @@
 data "http" "service_spec_template" {
   count = var.git_provider != "local" ? 1 : 0
-  url = var.git_provider == "github" ? (
-    "${local.raw_base_url}/specs/service-spec.json.tpl"
-  ) : (
+  url = (
+    var.git_provider == "github" ? "${local.raw_base_url}/specs/service-spec.json.tpl" :
+    var.git_provider == "bitbucket" ? "${local.bitbucket_raw_prefix}/specs/service-spec.json.tpl" :
     "${local.gitlab_api_file_prefix}${local.gitlab_path_sep}specs%2Fservice-spec.json.tpl/raw?ref=${var.repository_branch}"
   )
   request_headers = local.auth_headers
 }
 
 data "http" "action_templates" {
-  for_each        = var.git_provider != "local" ? toset(local.available_actions) : toset([])
-  url = var.git_provider == "github" ? (
-    "${local.raw_base_url}/specs/actions/${each.key}.json.tpl"
-  ) : (
+  for_each = var.git_provider != "local" ? toset(local.available_actions) : toset([])
+  url = (
+    var.git_provider == "github" ? "${local.raw_base_url}/specs/actions/${each.key}.json.tpl" :
+    var.git_provider == "bitbucket" ? "${local.bitbucket_raw_prefix}/specs/actions/${each.key}.json.tpl" :
     "${local.gitlab_api_file_prefix}${local.gitlab_path_sep}specs%2Factions%2F${each.key}.json.tpl/raw?ref=${var.repository_branch}"
   )
   request_headers = local.auth_headers
 }
 
 data "http" "link_templates" {
-  for_each        = var.git_provider != "local" ? toset(local.available_links) : toset([])
-  url = var.git_provider == "github" ? (
-    "${local.raw_base_url}/specs/links/${each.key}.json.tpl"
-  ) : (
+  for_each = var.git_provider != "local" ? toset(local.available_links) : toset([])
+  url = (
+    var.git_provider == "github" ? "${local.raw_base_url}/specs/links/${each.key}.json.tpl" :
+    var.git_provider == "bitbucket" ? "${local.bitbucket_raw_prefix}/specs/links/${each.key}.json.tpl" :
     "${local.gitlab_api_file_prefix}${local.gitlab_path_sep}specs%2Flinks%2F${each.key}.json.tpl/raw?ref=${var.repository_branch}"
   )
   request_headers = local.auth_headers
diff --git a/nullplatform/service_definition/locals.tf b/nullplatform/service_definition/locals.tf
index f8c5ddca..c85b4cb2 100644
--- a/nullplatform/service_definition/locals.tf
+++ b/nullplatform/service_definition/locals.tf
@@ -9,14 +9,31 @@ locals {
   gitlab_api_file_prefix       = "https://${var.gitlab_host}/api/v4/projects/${local._gitlab_project_encoded}/repository/files/${local._gitlab_service_path_encoded}"
   # Separator between service_path and the specs/ segment: omitted when service_path is empty
   # to avoid a leading %2F that causes GitLab API to return a 404.
-  gitlab_path_sep              = var.service_path != "" ? "%2F" : ""
+  gitlab_path_sep = var.service_path != "" ? "%2F" : ""
 
-  auth_headers = var.repository_token == null ? {} : (
-    var.git_provider == "github" ? (
-      { Authorization = "Bearer ${var.repository_token}" }
-    ) : (
-      { PRIVATE-TOKEN = var.repository_token }
-    )
+  # Bitbucket Cloud: the canonical repository URL (Contract A: no .git, no trailing slash),
+  # then the raw file endpoint underneath it. The service_path segment is appended only when
+  # set, to avoid a double slash that Bitbucket's raw endpoint rejects.
+  bitbucket_repo_url   = "https://bitbucket.org/${var.repository_org}/${var.repository_name}"
+  bitbucket_raw_prefix = "${local.bitbucket_repo_url}/raw/${var.repository_branch}${var.service_path != "" ? "/${var.service_path}" : ""}"
+
+  # Auth header per provider, enumerated explicitly rather than relying on a positional
+  # fallback:
+  #   - GitLab: PRIVATE-TOKEN header.
+  #   - Bitbucket: HTTP Basic "email:api_token" when bitbucket_email is set. Atlassian API
+  #     tokens (the program's standard bot-user credential) authenticate ONLY via Basic and
+  #     return 401 on Bearer. When bitbucket_email is null the token is treated as a Bitbucket
+  #     workspace/repository access token and sent as Bearer.
+  #   - GitHub (and any other): Bearer token header.
+  auth_headers = (
+    var.repository_token == null ? {} :
+    var.git_provider == "gitlab" ? { PRIVATE-TOKEN = var.repository_token } :
+    var.git_provider == "bitbucket" ? (
+      var.bitbucket_email != null
+      ? { Authorization = "Basic ${base64encode("${var.bitbucket_email}:${var.repository_token}")}" }
+      : { Authorization = "Bearer ${var.repository_token}" }
+    ) :
+    { Authorization = "Bearer ${var.repository_token}" }
   )
 }
 
@@ -24,7 +41,7 @@ locals {
   # Parse specs from local filesystem or HTTP depending on git_provider
   service_spec_parsed = var.git_provider == "local" ? (
     jsondecode(file("${var.local_specs_path}/specs/service-spec.json.tpl"))
-  ) : (
+    ) : (
     jsondecode(data.http.service_spec_template[0].response_body)
   )
 
@@ -38,7 +55,7 @@ locals {
     for name in local.available_links :
     name => var.git_provider == "local" ? (
       jsondecode(file("${var.local_specs_path}/specs/links/${name}.json.tpl"))
-    ) : (
+      ) : (
       jsondecode(data.http.link_templates[name].response_body)
     )
   }
@@ -49,7 +66,7 @@ locals {
     for name in local.available_actions :
     name => var.git_provider == "local" ? (
       jsondecode(file("${var.local_specs_path}/specs/actions/${name}.json.tpl"))
-    ) : (
+      ) : (
       jsondecode(data.http.action_templates[name].response_body)
     )
   }
diff --git a/nullplatform/service_definition/variables.tf b/nullplatform/service_definition/variables.tf
index c691e3e4..70217614 100644
--- a/nullplatform/service_definition/variables.tf
+++ b/nullplatform/service_definition/variables.tf
@@ -6,10 +6,10 @@ variable "nrn" {
 variable "git_provider" {
   type        = string
   default     = "github"
-  description = "Git provider to fetch service specs from. Supported values: \"github\", \"gitlab\", \"local\"."
+  description = "Git provider to fetch service specs from. Supported values: \"github\", \"gitlab\", \"bitbucket\", \"local\"."
   validation {
-    condition     = contains(["github", "gitlab", "local"], var.git_provider)
-    error_message = "git_provider must be \"github\", \"gitlab\", or \"local\"."
+    condition     = contains(["github", "gitlab", "bitbucket", "local"], var.git_provider)
+    error_message = "git_provider must be \"github\", \"gitlab\", \"bitbucket\", or \"local\"."
   }
 }
 
@@ -72,6 +72,12 @@ variable "gitlab_host" {
   description = "GitLab host. Only used when git_provider = \"gitlab\". Override for self-hosted instances (e.g. \"gitlab.mycompany.com\")."
 }
 
+variable "bitbucket_email" {
+  type        = string
+  default     = null
+  description = "Bitbucket account email, used only when git_provider = \"bitbucket\". Set it when repository_token is an Atlassian API token: those authenticate ONLY via HTTP Basic \"email:api_token\" and return 401 with a Bearer header. Leave null when repository_token is a Bitbucket workspace/repository access token, which is sent as a Bearer token."
+}
+
 variable "extra_visibile_to_nrns" {
   type        = list(string)
   default     = []